fix(multiplayer): reject websocket caps before upgrade

server/api/events_connection_test.go

@@ -1,6 +1,10 @@
 package api
 
-import "testing"
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
 
 func TestEventHubCapsConnectionsPerPlayerAndReleasesCapacity(t *testing.T) {
 	hub := newEventHub()
@@ -20,3 +24,23 @@ func TestEventHubCapsConnectionsPerPlayerAndReleasesCapacity(t *testing.T) {
 	}
 	hub.unsubscribe(second)
 }
+
+func TestEventConnectionCapReturnsHTTP429BeforeUpgrade(t *testing.T) {
+	service := &Service{SessionBackend: &sessionBackendSpy{}}
+	hub := service.getEventHub()
+	first := hub.subscribe("player-1")
+	second := hub.subscribe("player-1")
+	defer hub.unsubscribe(first)
+	defer hub.unsubscribe(second)
+	request := httptest.NewRequest(http.MethodGet, "/v1/events", nil)
+	request.Header.Set("Upgrade", "websocket")
+	request.Header.Set("Connection", "Upgrade")
+	request.Header.Set("Sec-WebSocket-Version", "13")
+	request.Header.Set("Sec-WebSocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+	request.Header.Set("Authorization", "Bearer session-1:token-1")
+	recorder := httptest.NewRecorder()
+	service.controlPlaneEvent(recorder, request)
+	if recorder.Code != http.StatusTooManyRequests {
+		t.Fatalf("connection-cap status = %d, want 429", recorder.Code)
+	}
+}